Hundreds were forced to flee the bloodshed at the DusitD2 hotel and business complex on Tuesday.
Some 28 injured people have been admitted to hospital, and Kenya's Red Cross said 19 are still missing.
Somalia-based Islamist group al-Shabab said it was behind the attack, which triggered a 19-hour security operation.
President Uhuru Kenyatta said the siege ended with five jihadist attackers "eliminated".
Kenya has been a target for al-Shabab since October 2011, when it sent its army into Somalia to fight the jihadist group.
The BBC's Andrew Harding, in Nairobi, says cowering groups of civilians were escorted to safety by security forces throughout Tuesday night, amid sporadic bursts of gunfire and the boom of explosions that continued well beyond dawn. Many had spent hours hiding in their offices, or in bathrooms.
On the crowded street outside the large, upmarket complex, friends and relatives embraced those who emerged and thanked Kenyan security forces.
Mourners have now begun to bury the dead.